Thanks! So if I do make a signature using GPG, it might still silently sign just an MD5 digest, if I didn't (re-)configure it properly? That sounds scary...
Note that the MD5 hash appended to the plaintext is probably just an add hoc system to provide integrity protection[1] of the plaintext. The scenario is that Alice sends Bob an encrypted message without a signature and Eve selectively tampers with the plaintext (without being able to decrypt the message though). For example if you use the CTR block cipher mode[2] you can switch any bits of the plaintext (by switching the corresponding bits of the ciphertext). The MD5 hash of the message at the end supposedly adds enough structure so that such attack is impossible. This added security layer does not rely on collision resistance but on the avalanche effect[3].
Nowadays you would add a MAC[4] to the message or use an authenticated encryption scheme[5] instead of just an encryption mode to achieve message integrity. But PGP, like SSL, comes from the Bronze Age of cryptography and does not really adhere to modern best practices.
Thanks for the detailed answer. I see why MD5 is harmless here, now.
I still wonder why anyone does anything with MD5 anymore, especially in an application like GPG... if it is known to be weak... It makes the argument why it is still safe in this situation much more subtle and involved. From all the crypto gurus, we hear 'MD5 is unsafe, do not use it anymore!!' and then in PGP/GPG, MD5 is still used because, well apparently for historic reasons and because one can.
As a non-expert in these matters, this looks very odd. It seems to (needlessly) make matters more complicated and involved, more complex in terms of the necessary analysis, and on the other hand unnecessary complexity is (rightfully) despised by the same security people...
If they'd use SHA256 or similar, one could simply assume all of the properties of an unbroken cryptographic hashing function and throw out the MD5 code.
So in the end, the only valid excuse here would be history+inertia.
True, but inertia and backwards compatibility is hell of an opponent. IPv6 turned 10 years old recently and we are still far away from universal deployment. TLS 1.2 only got more traction once BEAST - a proof of concept for a paper that was published years earlier - made some waves. And with PGP you have the additional problem that there is no standard way to find out which changes to the bases protocol the client of the recipient supports.
If we could ignore inertia and backwards compatibility we could collectively switch to some TextSecure style messaging over Tor with key distribution via DANE for universal end to end encryption with meta data protection. Alas, that is not how our world works…
